Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Leading the security function

Starting, running and handing over a security function: the first 90 days, maturity, awareness and priorities.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do I hand over the function when I leave?
  2. How do I find out what an inherited security programme really does, as opposed to what it claims?
  3. How do I decide who to interview first, and what to ask?
  4. How do I record my starting position so I can show progress at the end of the first year?
  5. How do I brief the executives at the end of discovery?
  6. How do I build a hundred-day plan that mixes quick wins with the decisions that take longer?
  7. How do I plan the first year of recurring reviews, reports and renewals?
  8. How do we tell whether our security programme is mature, and which gaps matter?
  9. How do we score maturity consistently when different people assess?
  10. How do we tell whether evidence actually proves the level someone claims?
  11. How do we set target maturity levels without aiming for the top everywhere?
  12. How do we turn maturity gaps into an improvement plan the budget can carry?
  13. How do we test whether a security control actually works between audits?
  14. How many samples do we need when testing a control?
  15. What evidence is good enough to show a control operated?
  16. How do we rate a control deficiency and set its deadline?
  17. How do we plan a year of control testing around audits and reviews?
  18. How do we test a control once and use the result for several frameworks?
  19. How do we run awareness training that changes behaviour, not just completion rates?
  20. How do we plan a year of awareness from our own incidents and risks?
  21. How do we run phishing simulations that teach rather than punish?
  22. How do I set next year's priorities with a fixed budget?

When do we…

Triggers and timing: when something has to happen.

  1. What do I do in my first 90 days as a new CISO?
  2. When should we commission an independent assessment instead of self-assessing?
  3. When can we close an improvement action, and when do we re-assess?
  4. When do we know whether awareness is working, and what do we measure?

Who decides…

Authority: who may approve, accept or act.

  1. Which decisions can I make myself in my first months, and which do I share or escalate?
  2. Who should assess our security practices when the team is too small to be independent?
  3. Who should test our controls when the team is too small to be independent?
  4. Who needs more than the standard awareness training, and what?

If…, then how…

Situations: something has happened, what now.

  1. If I inherit a programme with no documentation, where do I start?
  2. If my predecessor left without a handover, then how do I rebuild what I need?
  3. If a re-assessment shows a lower level than last time, then what do we do?
  4. If a control test finds an exception, has the control failed?
  5. If the same person keeps clicking simulated phishing emails, then what do we do?

Other categories